JordanCybercrime Law, Unauthorized Access to Information Systems
Law No. 17 of 2023 on Cybercrime, Arts. 3-4, 6-7
In force.
A computer misuse rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- User location, Place of effect
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not access a website, information network, information system, or information technology means, in whole or in part, without authorization or in excess of an authorization granted.
- Do not use a program or program command to disable, alter, damage, or gain unauthorized access to an information system, and do not intercept or capture data transmitted through one.
- Accessing a network, system, or website belonging to a government, security, financial, or banking institution without permission, or in excess of a permit, carries a heightened penalty where it reaches non-public data affecting national security, foreign relations, public safety, or the national economy.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Article 3's base offense (accessing an information system, network, or website without authorization or in excess of an authorization) carries imprisonment of one week to three months or a fine of 300 to 600 Dinars, or both; the fine rises to 600 to 3,000 Dinars where the access targets data for alteration or disclosure, and to 3,000 to 15,000 Dinars where that result is achieved. Article 4's aggravated offense, reaching a government, security, financial, or banking system, carries a separate range of 2,500 to 25,000 Dinars, rising to temporary servitude and a fine of 5,000 to 25,000 Dinars where the access is also used to alter or disclose the data, and to temporary servitude of at least five years and a 25,000-Dinar fine if that result is achieved. Article 6 (disabling or interfering with an information system) carries 2,500 to 10,000 Dinars, and Article 7 (interception) carries 1,500 to 6,000 Dinars, rising to 15,000 to 45,000 Dinars and temporary servitude of at least five years where the interception targets an official authority.
Penalty structure
Article 3 alone carries three tiers: 300-600 Dinars for the base unauthorized-access offense, 600-3,000 Dinars where the access targets data for alteration or disclosure, and 3,000-15,000 Dinars where that result is achieved. Articles 4, 6, and 7 carry separate, higher fine ranges (up to 25,000, 10,000, and 45,000 Dinars respectively) for access to government or financial systems, system interference, and interception.
- Rule
- Fixed only
- As of
- Minimum
- 300
- Currency
- JOD
- Fixed cap
- 15,000
What it makes you log
Logging duty
Articles 3, 4, 6 and 7 define offences: intentional access without authorization, access to government, financial or critical systems, introducing a harmful program, and unlawful interception or recording of data in transit. None of the four creates a duty to keep, produce or review a log or record; the recording named in Article 7 is the offender's act. The Law's later preservation and production powers (Articles 32 and 33) lie outside the cited articles and are not read into this row.
- Kind
- None
- As of
What this law does
Article 3 punishes whoever intentionally accesses a website, information network, information system, or information technology means, or any part of it, without authorization or in excess of an authorization, with imprisonment of one week to three months or a fine of 300 to 600 Dinars, or both.
The penalty rises to three months to one year and a fine of 600 to 3,000 Dinars where the access is for the purpose of cancelling, deleting, damaging, disclosing, or otherwise altering data, and to one to three years and a fine of 3,000 to 15,000 Dinars where that result is achieved.
Article 4 raises the penalty to six months to three years and a fine of 2,500 to 25,000 Dinars where the access reaches an information network or system belonging to a ministry, government department, public institution, or a security, financial, or banking institution, or to critical infrastructure, and the person views non-public data touching national security, the Kingdom's foreign relations, public safety, or the national economy; for access to such a body's website with the aim of viewing that data, Article 4 sets imprisonment of four months to three years and the same fine.
Where either kind of access is also used to cancel, damage, destroy, or otherwise alter or disclose the data, Article 4 raises the penalty further to temporary servitude and a fine of 5,000 to 25,000 Dinars, or temporary servitude of at least five years and a fine of 25,000 Dinars if the result is achieved.
Article 6 separately punishes intentionally using a program or program command to disable, alter, or gain unauthorized access to an information system, with imprisonment of at least six months and a fine of 2,500 to 10,000 Dinars.
Article 7 punishes unlawfully intercepting or capturing a data flow with imprisonment of at least six months and a fine of 1,500 to 6,000 Dinars, rising to temporary servitude of at least five years and a fine of 15,000 to 45,000 Dinars where the interception targets an official authority's communications. None of these articles names a web crawler, an automated collection tool, or the robots exclusion protocol.
Article 1 of the Law provides that it comes into force thirty days after its publication in the Official Gazette. No official source located states the resulting day.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .